Cisco Catalyst SD-WAN Manager file-overwrite flaw CVE-2026-20122 exploited; fixes available
Attackers exploited CVE-2026-20122 in Cisco’s business network-management software, including in chains that installed backdoors. Ask your IT provider to update affected systems and check for compromise.
There is nothing to update on ordinary family devices. If your business or family office uses Cisco Catalyst SD-WAN Manager, ask its IT provider to install the appropriate fixed release below, restrict management access to trusted hosts and check for compromise using Cisco’s guidance.
What’s happening
CVE-2026-20122 affects Cisco Catalyst SD-WAN Manager, formerly vManage, which organisations use to manage their networks. An attacker with a valid read-only account and API access can overwrite files and gain the privileges of the vmanage system account. Cisco released fixes in February and confirmed attacks in March. In May, Cisco Talos reported widespread exploitation involving this flaw and two others, with attackers installing backdoors, stealing credentials and mining cryptocurrency. Fixes remain available; older branches require migration. The reviewed sources do not establish that attacks have ended or give a total victim count. Cisco’s advisory rates the flaw high, at 7.1; NVD lists a different score of 5.4, medium.
- What
- Flaw
- Affects
- Cisco Catalyst SD-WAN Manager (formerly vManage)
- Affected
- Earlier than 20.9: migrate to a fixed release
20.9 before 20.9.8.2
20.10 and 20.11: migrate to 20.12.6.1
20.12 before 20.12.5.3, and 20.12.6
20.13 and 20.14: migrate to 20.15.4.2
20.15 before 20.15.4.2
20.16: migrate to 20.18.2.1
20.18 before 20.18.2.1 - Fixed in
- 20.9.8.2
20.12.5.3
20.12.6.1
20.15.4.2
20.18.2.1 - Since
- 20 Apr 2026
- Closed
- 14 May 2026
Timeline
- Wider attacks
Cisco Talos reported widespread exploitation of unpatched systems during March and April, identifying ten clusters of malicious activity. Attackers installed backdoors, cryptocurrency miners and credential-stealing software.
- CISA added
CISA added CVE-2026-20122 to its Known Exploited Vulnerabilities catalogue, as confirmed by Canada’s Cyber Centre.
- Vendor revised
Cisco added compromise indicators and the upgrade path for release 20.10 to its advisory.
- Wider attacks
Cisco publicly confirmed active exploitation of CVE-2026-20122 and urged administrators to upgrade.
- Wider attacks
Attackers were exploiting this flaw alongside two others and installing backdoors by at least this date, according to Cisco Talos’s subsequent investigation.
- Made publicFixed
Cisco disclosed CVE-2026-20122 and released software fixes. No workaround was available.
Sources
- Cisco Catalyst SD-WAN VulnerabilitiesCisco · 22 Apr 2026
- Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilitiesCisco Talos · 14 May 2026
- Cisco flags more SD-WAN flaws as actively exploited in attacksBleepingComputer · 5 Mar 2026
- Cisco security advisory (AV26-166) – Update 3Canadian Centre for Cyber Security · 20 Apr 2026
- CVE-2026-20122 DetailNIST National Vulnerability Database · 17 June 2026